Imagination Graphics DDK EUVD-2026-43032

Requires the attacker to already run code as a local non-privileged user on a device whose kernel loads a vulnerable Imagination Graphics DDK build (1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1 RTM2-25.3 RTM, or 26.1 RTM1) and to have access to the PowerVR GPU device interface to issue the mapping system calls. The exploit hinges on triggering an integer overflow in the GPU virtual-to-physical mapping path to produce two VAs aliasing one physical page, then winning a reallocation race after freeing the first mapping so the freed page is reused by a victim. Limiting factors: no remote vector (local access mandatory; PR:L means the attacker must already hold an execution foothold), success depends on reaching the GPU driver ioctl surface (which OS sandboxing may restrict) and on the freed physical page being reallocated to a target of interest; no user interaction is needed.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) is internally consistent and matches the description: exploitation needs only local access as an already-running non-privileged process, with low complexity and no user interaction, yielding full confidentiality, integrity and availability impact within an unchanged scope. EPSS is low (0.15%, 5th percentile), the CVE is not in CISA KEV, and no POC is referenced - signals pointing to no widespread automated exploitation today. However, EPSS/KEV systematically under-weight local GPU driver bugs, which are rarely mass-scanned yet highly prized for sandbox escapes and root escalation on mobile/embedded devices; a controllable read/write UAF over reallocated physical memory is a classic, reliable exploitation primitive. Net: a genuine escalation-of-privilege priority for any device shipping the affected DDK, not a high-CVSS-but-low-real-risk issue, even though internet-facing mass exploitation is not the threat model. The description implies local access, which AV:L correctly reflects - no conflict among signals.

A malicious or compromised non-privileged app on a device using the vulnerable PowerVR DDK issues crafted GPU mapping system calls that overflow an internal size calculation, creating two GPU virtual mappings aliased to one physical page. The app frees the first mapping (releasing the physical page), lets the kernel reallocate that page to another process or privileged structure, then reads and writes it through the still-valid second mapping to leak secrets or corrupt memory toward privilege escalation. No public exploit is identified at time of analysis, but the low-complexity local vector makes a reliable weaponized exploit plausible.